registry / retold-data-service / 2.1.6

retold-data-service@2.1.6

Serve up a whole model!

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 94 file(s), 4.22 MB of source, external domains: covers.example.com, example.com, feross.org, garden.example.com, github.com, velozo.com, www.w3.org

Source & flagged code

8 flagged

tools/smoke-converge-endpoint.jsView file

Lines 2-57javascript

3/**

4 * Live smoke test for the DataCloner index-convergence endpoint.

5 *

6 * Spawns the REAL data-cloner service and drives the actual HTTP path a headless

7 * clone uses: configure connection → fetch schema → deploy → POST

8 * /clone/schema/indices/converge → converge again (idempotency). Asserts the

9 * operational indexes the policy declares are the ones the endpoint creates,

10 * that a table with neither Deleted nor GUID gets none, and that a second run is

11 * a no-op. Exercises the provider registry + RetoldDataServiceConnectionManager

12 * + IndexPolicy + IndexConvergence together — the production service path.

13 *

14 * Uses retold's own committed BookStore test model (no external data).

15 *

16 * Usage: node tools/smoke-converge-endpoint.js [SQLite|MSSQL] [port]

17 * SQLite (default): zero infra.

18 * MSSQL: runtime-configures the local meadow-connection-mssql-test container

19 * (localhost:21433 / sa / db clonesmoke) and adds an independent

20 * sqlcmd cross-check + a managed-prune-through-the-endpoint check.

21 */

23const libChildProcess = require('child_process');

24const libHttp = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smoke-converge-endpoint.jsView on unpkg · L22

25const libPath = require('path');

26const libOs = require('os');

27const libFs = require('fs');

29const libIndexPolicy = require('meadow-integration/source/services/clone/Meadow-Service-IndexPolicy.js');

31const PROVIDER = process.argv[2] || 'SQLite';

32const PORT = parseInt(process.argv[3], 10) || 9500;

33const BASE = `http://localhost:${PORT}`;

34const DEPLOY_TABLES = [ 'Book', 'Author', 'BookAuthorJoin' ]; // Book/Author: Deleted+GUID; join: neither

35const MODEL = require('../test/model/MeadowModel-Extended.json');

37const MSSQL_CONFIG = { server: 'localhost', port: 21433, user: 'sa', password: 'Retold1234567890!', database: 'clonesmoke', ConnectionPoolLimit: 5 };

Medium

Secret Pattern

Package contains a possible secret pattern.

tools/smoke-converge-endpoint.jsView on unpkg · L37

38const MSSQL_CONTAINER = 'meadow-connection-mssql-test';

39const SQLCMD = '/opt/mssql-tools18/bin/sqlcmd';

41let _pass = 0, _fail = 0;

42function check(pCondition, pMessage)

43{

44 if (pCondition) { _pass++; console.log(`[ok] ${pMessage}`); }

45 else { _fail++; console.log(`[fail] ${pMessage}`); }

46}

48// -- tiny HTTP JSON client (promise) --

49function httpJSON(pMethod, pPath, pBody)

50{

51 return new Promise((fResolve, fReject) =>

52 {

53 let tmpData = pBody ? JSON.stringify(pBody) : null;

54 let tmpReq = libHttp.request(`${BASE}${pPath}`,

55 { method: pMethod, headers: { 'Content-Type': 'application/json', 'Content-Length': tmpData ? Buffer.byteLength(tmpData) : 0 } },

56 (pRes) =>

57 {

source/services/comprehension-loader/web/pict.min.jsView file

1"use strict";function _slicedToArray(e,t){return _arrayWithHoles(e)||_iterableToArrayLimit(e,t)||_unsupportedIterableToArray(e,t)||_nonIterableRest()}function _nonIterableRest(){th... L2: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

source/services/comprehension-loader/web/pict.min.jsView on unpkg · L1

source/services/integration-telemetry/IntegrationTelemetry-StorageProvider-Bibliograph.jsView file

Lines 135-175javascript

135

136 this.ensureSource(tmpTenantSource,

137 (pError) =>

138 {

139 if (pError)

140 {

141 this.fable.log.error(`IntegrationTelemetry Bibliograph: Error ensuring tenant source [${tmpTenantSource}]: ${

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView file

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = payload_in_excluded_dir sizeBytes = 247 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = build_helper sizeBytes = 247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

source/services/comprehension-loader/ComprehensionLoader-Command-Session.jsView file

Lines 80-120javascript

80 AuthenticationMethod: tmpBody.AuthenticationMethod || 'get',

81 AuthenticationURITemplate: fQualifyURI(tmpBody.AuthenticationURITemplate, 'Authenticate/{~D:Record.UserName~}/{~D:Record.Password~}'),

82 AuthenticationRetryCount: 2,

83 AuthenticationRetryDebounce: 200,

source/services/data-cloner/DataCloner-Command-Session.jsView file

Lines 88-128javascript

88 AuthenticationRetryDebounce: 200,

90 // Session check

91 CheckSessionURITemplate: fQualifyURI(tmpBody.CheckSessionURITemplate, 'CheckSession'),

92 CheckSessionLoginMarkerType: tmpBody.CheckSessionLoginMarkerType || 'boolean',

93 CheckSessionLoginMarker: tmpBody.CheckSessionLoginMarker ||

Source & flagged code

8 flagged · loading source

tools/smoke-converge-endpoint.jsView file

37patternName = generic_password severity = medium line = 37 matchedText = const MS...5 };

Medium

Secret Pattern

Package contains a possible secret pattern.

tools/smoke-converge-endpoint.jsView on unpkg · L37

22L23: const libChildProcess = require('child_process'); L24: const libHttp = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smoke-converge-endpoint.jsView on unpkg · L22

source/services/comprehension-loader/web/pict.min.jsView file

1"use strict";function _slicedToArray(e,t){return _arrayWithHoles(e)||_iterableToArrayLimit(e,t)||_unsupportedIterableToArray(e,t)||_nonIterableRest()}function _nonIterableRest(){th... L2: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

source/services/comprehension-loader/web/pict.min.jsView on unpkg · L1

source/services/integration-telemetry/IntegrationTelemetry-StorageProvider-Bibliograph.jsView file

155// Dual-write: tenant source + global source L156: this.bibliograph.write(tmpTenantSource, tmpTenantKey, pRunRecord, L157: (pWriteError) =>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

source/services/integration-telemetry/IntegrationTelemetry-StorageProvider-Bibliograph.jsView on unpkg · L155

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView file

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = payload_in_excluded_dir sizeBytes = 247 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = build_helper sizeBytes = 247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

source/services/comprehension-loader/ComprehensionLoader-Command-Session.jsView file

100patternName = generic_password severity = medium line = 100 matchedText = password...d~}'

Medium

Secret Pattern

Hardcoded password in source/services/comprehension-loader/ComprehensionLoader-Command-Session.js

source/services/comprehension-loader/ComprehensionLoader-Command-Session.jsView on unpkg · L100

source/services/data-cloner/DataCloner-Command-Session.jsView file

108patternName = generic_password severity = medium line = 108 matchedText = password...d~}'

Medium

Secret Pattern

Hardcoded password in source/services/data-cloner/DataCloner-Command-Session.js

source/services/data-cloner/DataCloner-Command-Session.jsView on unpkg · L108

Findings

1 High9 Medium8 Low

HighPayload In Excluded Dir.config/luxury-extras/MySQL/MySQL-Laden-Entry.sh

MediumSecret Patterntools/smoke-converge-endpoint.js

MediumDynamic Requiretools/smoke-converge-endpoint.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helper.config/luxury-extras/MySQL/MySQL-Laden-Entry.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternsource/services/comprehension-loader/ComprehensionLoader-Command-Session.js

MediumSecret Patternsource/services/data-cloner/DataCloner-Command-Session.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsource/services/comprehension-loader/web/pict.min.js

LowWeak Cryptosource/services/integration-telemetry/IntegrationTelemetry-StorageProvider-Bibliograph.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

tools/smoke-converge-endpoint.jsView file

Lines 2-57javascript

3/**

4 * Live smoke test for the DataCloner index-convergence endpoint.

5 *

6 * Spawns the REAL data-cloner service and drives the actual HTTP path a headless

7 * clone uses: configure connection → fetch schema → deploy → POST

8 * /clone/schema/indices/converge → converge again (idempotency). Asserts the

9 * operational indexes the policy declares are the ones the endpoint creates,

10 * that a table with neither Deleted nor GUID gets none, and that a second run is

11 * a no-op. Exercises the provider registry + RetoldDataServiceConnectionManager

12 * + IndexPolicy + IndexConvergence together — the production service path.

13 *

14 * Uses retold's own committed BookStore test model (no external data).

15 *

16 * Usage: node tools/smoke-converge-endpoint.js [SQLite|MSSQL] [port]

17 * SQLite (default): zero infra.

18 * MSSQL: runtime-configures the local meadow-connection-mssql-test container

19 * (localhost:21433 / sa / db clonesmoke) and adds an independent

20 * sqlcmd cross-check + a managed-prune-through-the-endpoint check.

21 */

23const libChildProcess = require('child_process');

24const libHttp = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smoke-converge-endpoint.jsView on unpkg · L22

25const libPath = require('path');

26const libOs = require('os');

27const libFs = require('fs');

29const libIndexPolicy = require('meadow-integration/source/services/clone/Meadow-Service-IndexPolicy.js');

31const PROVIDER = process.argv[2] || 'SQLite';

32const PORT = parseInt(process.argv[3], 10) || 9500;

33const BASE = `http://localhost:${PORT}`;

34const DEPLOY_TABLES = [ 'Book', 'Author', 'BookAuthorJoin' ]; // Book/Author: Deleted+GUID; join: neither

35const MODEL = require('../test/model/MeadowModel-Extended.json');

37const MSSQL_CONFIG = { server: 'localhost', port: 21433, user: 'sa', password: 'Retold1234567890!', database: 'clonesmoke', ConnectionPoolLimit: 5 };

Medium

Secret Pattern

Package contains a possible secret pattern.

tools/smoke-converge-endpoint.jsView on unpkg · L37

38const MSSQL_CONTAINER = 'meadow-connection-mssql-test';

39const SQLCMD = '/opt/mssql-tools18/bin/sqlcmd';

41let _pass = 0, _fail = 0;

42function check(pCondition, pMessage)

43{

44 if (pCondition) { _pass++; console.log(`[ok] ${pMessage}`); }

45 else { _fail++; console.log(`[fail] ${pMessage}`); }

46}

48// -- tiny HTTP JSON client (promise) --

49function httpJSON(pMethod, pPath, pBody)

50{

51 return new Promise((fResolve, fReject) =>

52 {

53 let tmpData = pBody ? JSON.stringify(pBody) : null;

54 let tmpReq = libHttp.request(`${BASE}${pPath}`,

55 { method: pMethod, headers: { 'Content-Type': 'application/json', 'Content-Length': tmpData ? Buffer.byteLength(tmpData) : 0 } },

56 (pRes) =>

57 {

source/services/comprehension-loader/web/pict.min.jsView file

1"use strict";function _slicedToArray(e,t){return _arrayWithHoles(e)||_iterableToArrayLimit(e,t)||_unsupportedIterableToArray(e,t)||_nonIterableRest()}function _nonIterableRest(){th... L2: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

source/services/comprehension-loader/web/pict.min.jsView on unpkg · L1

source/services/integration-telemetry/IntegrationTelemetry-StorageProvider-Bibliograph.jsView file

Lines 135-175javascript

135

136 this.ensureSource(tmpTenantSource,

137 (pError) =>

138 {

139 if (pError)

140 {

141 this.fable.log.error(`IntegrationTelemetry Bibliograph: Error ensuring tenant source [${tmpTenantSource}]: ${

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView file

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = payload_in_excluded_dir sizeBytes = 247 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

•path = .config/luxury-extras/MySQL/MySQL-Laden-Entry.sh kind = build_helper sizeBytes = 247 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.config/luxury-extras/MySQL/MySQL-Laden-Entry.shView on unpkg

source/services/comprehension-loader/ComprehensionLoader-Command-Session.jsView file

Lines 80-120javascript

80 AuthenticationMethod: tmpBody.AuthenticationMethod || 'get',

81 AuthenticationURITemplate: fQualifyURI(tmpBody.AuthenticationURITemplate, 'Authenticate/{~D:Record.UserName~}/{~D:Record.Password~}'),

82 AuthenticationRetryCount: 2,

83 AuthenticationRetryDebounce: 200,

source/services/data-cloner/DataCloner-Command-Session.jsView file

Lines 88-128javascript

88 AuthenticationRetryDebounce: 200,

90 // Session check

91 CheckSessionURITemplate: fQualifyURI(tmpBody.CheckSessionURITemplate, 'CheckSession'),

92 CheckSessionLoginMarkerType: tmpBody.CheckSessionLoginMarkerType || 'boolean',

93 CheckSessionLoginMarker: tmpBody.CheckSessionLoginMarker ||